Interval-Observer-Based Attack Detection and HOCBF-Safe Control for Markov-Jump Microgrids

Modern power grids are no longer just a collection of wires and generators; they are complex cyber-physical systems where the physical flow of electricity is inextricably linked to digital communication networks. This integration allows for smarter management of energy, but it also opens the door to new kinds of threats. When a microgrid—a localized version of the grid that can operate independently—switches between different operating modes, such as connecting to the main grid or running on its own with renewable energy, its behavior changes rapidly and unpredictably. These changes, combined with the constant noise of sensors and the possibility of malicious cyber-attacks that inject false data, make it incredibly difficult to know exactly what is happening inside the system at any given moment. If the system cannot accurately track its own state, it cannot guarantee that critical variables, like electrical frequency, stay within safe limits, which could lead to blackouts or equipment damage.

In a recent study, researchers at Amirkabir University of Technology tackled this challenge by developing a new framework designed to keep uncertain and potentially under-attack microgrids safe. The core of their work involves two main ideas working in tandem: a way to estimate the system's state with guaranteed boundaries, and a safety filter that acts as a final guardian to prevent the system from entering dangerous territory. Instead of trying to pinpoint the exact, fluctuating state of the grid, which is often impossible due to hidden changes and noise, the researchers built an "interval observer." Think of this not as a single guess, but as a shrinking and expanding box that is mathematically guaranteed to contain the true state of the system, no matter how the grid switches modes or how much noise interferes. If a cyber-attacker tries to inject false data, this box will eventually fail to contain the measurements, triggering an immediate alarm.

The researchers tested their approach on a digital simulation of a microgrid that switches between three different operating regimes: standard grid-connected operation, a mode with high renewable energy penetration, and a heavy-load islanded mode. They programmed the system to switch between these states randomly, but with a rule that it must stay in one mode for at least three steps before changing again, mimicking real-world operational constraints. They also introduced a specific cyber-attack where false data was injected into the system's control loop for a period of fifty time steps. The results showed that their interval observer successfully kept the true state of the grid trapped within its calculated upper and lower bounds throughout the entire simulation, even as the system switched modes and the attack began.

Crucially, the system detected the attack the very moment the false data pushed the measurements outside the safe, predicted box. In this specific simulation, the alarm triggered instantly with zero delay, and no false alarms were raised during the hundreds of steps of normal operation. This deterministic detection is a significant departure from older methods that rely on probability, which can sometimes miss subtle attacks or raise false alarms due to random noise. Once the attack was detected, the second part of their framework, a safety filter based on high-order control barrier functions, took over. This filter acts like a smart brake, adjusting the control inputs just enough to ensure the electrical frequency never exceeded the safe limit of 0.08 per unit, even while the attack was active. The system managed to keep the frequency deviation at a peak of only 0.0621, leaving a comfortable safety margin.

The study demonstrates that it is possible to design control systems for complex, switching power grids that do not need to know the exact current mode of operation to remain safe and secure. By using a fixed, mode-independent observer to create a guaranteed envelope of uncertainty, the researchers showed that they could detect malicious intrusions with certainty and enforce strict safety rules without needing to solve complex, real-time identification problems. While these results were achieved through high-fidelity computer simulations rather than physical hardware tests, the mathematical proofs provided in the paper confirm that the system remains stable and safe under the specific conditions modeled. The work offers a promising path forward for securing the next generation of resilient, renewable-heavy power networks against the dual challenges of unpredictable switching and sophisticated cyber threats.